Mastercard has updated portions of its fraud loss controls and merchant monitoring requirements. Find out if your business could be classified as a scam.
What is the Mastercard Scam Merchant Monitoring Program?
In early 2026, Mastercard released announcement article GLB 12772 — Revised Standards for Potential Scam Merchant Monitoring.
The announcement introduces several new monitoring requirements for acquirers and penalties for merchants. It’s important to understand how the updates could impact your business.
But in typical card brand fashion, the announcement is very technical, nuanced, and difficult to understand.
We don’t want to just republish the announcement and make you sift through the jargon yourself. Instead, we’re going to break down the information, simplify the messaging, and outline potential implications.
NOTE
AltoPay has direct access to the team at Mastercard. We’ve already reached out to clarify several ambiguous points in the announcement. And we will continue to communicate with their team as additional questions and concerns arise.
We have already seen several misinterpretations of the scam merchant announcement. As you read about this topic, as well as any card scheme rule, be sure you’re getting facts and details that come directly from the source.
If you have questions about the recent update, feel free to contact the AltoPay team. If we can’t answer your questions, we’ll reach out to Mastercard for clarification.
Let’s take a closer look at the potential scam merchant monitoring program.
Program Goals & Potential Repercussions
Mastercard expects acquirers to monitor merchant activity to “avoid processing illegal or brand-damaging transactions”.
The intention of the scam merchant monitoring program is to help acquirers more easily identify merchants that could potentially be engaging in unscrupulous or fraudulent activities — which is a very valuable and important task. All parties in the payments ecosystem benefit when actual scams are identified and stopped.
However — as is the case with any drastic changes that are applied en masse — there is the possibility that merchants will be incorrectly classified and unfairly penalised.
Effective Date
The updated requirements will go into effect July 24, 2026.
Audience
The revised standards apply to acquirers. Acquirers are required to conduct ongoing risk reviews of their merchant portfolios. Now, with the new scam merchant program, acquirers have additional threats to watch for.
If certain risk factors are present, an acquirer must enforce applicable penalties against the merchant in question.
This is a global initiative. All merchants and acquirers — except those located in Jordan — are impacted by the new mandate.
Notification
All potential scam merchant notices are posted in Mastercard’s Fraud and Loss Database. Acquirers and payment facilitators are asked to check the FLD daily for new scam merchant listings.
Response Timeline
If your business is listed in the FLD as a potential scam merchant, your acquirer or payment facilitator must launch an investigation within 72 hours of your classification.
The announcement doesn’t specify how quickly penalties must be enforced. However, it’s logical to assume that action will quickly follow investigation — meaning, if your business is flagged, you can probably expect to hear from your acquirer within a few days of the FLD listing.
Penalty
If it is determined you are, in fact, a scam merchant, your acquirer or payment facilitator must block transaction authorisations. If applicable, your acquirer can also block transaction clearing, meaning you won’t receive funds from in-flight transactions.
There are no guidelines about whether or not these are temporary or permanent blocks. Therefore, each acquirer is left to interpret the rules as they wish.
Based on acquirer responses to similar card brand updates in the past, merchants classified as scams — whether correctly or incorrectly — will likely lose their merchant accounts and their ability to process payments.
Triggers
The Mastercard scam merchant monitoring program identifies merchants who engage in “activity that is or may potentially be illegal or brand-damaging.”
And there are five activities in particular that can trigger a scam merchant investigation.
NOTE
The intention of the Mastercard scam monitoring program is valid and valuable. However, we recognise that errors and misunderstandings are always a possibility with any major card brand update.
The information we share in this article is intended to help legitimate merchants avoid misclassification.
Let’s take a look at each trigger individually. Pay particular attention to the last two triggers.
TRIGGER #1
CAUSE: Your acquirer received a Mastercard Global Rules Investigation Program (GRIP) letter claiming you are a suspected scam merchant.
TIMELINE: Applicable at any point in the MID’s lifespan.
POTENTIAL IMPLICATIONS: The Global Rules Investigation Program is a catch-all for violations that fall outside the scope of other monitoring programs. GRIP can be used for everything from deceptive marketing practices to incorrect MCC assignments.
The use of GRIP is very subjective, so it can be challenging to understand the reason why you are identified. The use of GRIP is also difficult to anticipate, meaning there aren’t clear prevention tactics other than fully understanding and adhering to all Mastercard regulations in all situations at all times.
TRIGGER #2
CAUSE: Your acquirer received one or more Merchant Monitoring Service Provider (MMSP) alerts identifying your business as a potential scam merchant or otherwise suspected of conducting illegal activity.
TIMELINE: Applicable at any point in the MID’s lifespan.
POTENTIAL IMPLICATIONS: A Merchant Monitoring Service Provider is an independent third-party organization that works on Mastercard’s behalf to detect merchant fraud. An MMSP alert can be issued for violations ranging from misleading website content to non-compliance with Mastercard rules.
Again, like the GRIP mentioned above, MMSP alerts are used somewhat subjectively and obscurely. Also like GRIP, the only way to avoid this scam trigger is to maintain unceasing compliance with Mastercard and industry requirements.
TRIGGER #3
CAUSE: Your authorisation approval rate decreased by at least 50 percentage points — for example, 95% to 45%. Or Your authorisation approval rate dropped below 30%.
STIPULATIONS: Applicable only if you process 25 or more transactions over at least a 72-hour period.
TIMELINE: Applicable at any point in the MID’s lifespan.
POTENTIAL IMPLICATIONS: This trigger is like rubbing salt in a wound. You’ve already suffered a significant drop in approvals — meaning you’ve lost a ton of revenue. And then to add insult to injury, you’re classified as a scam and might lose your MID!
To avoid this scam trigger, optimise your authorisation strategy to get the highest approval rates possible. Here are some suggestions.
- Fraud and chargeback activity can have a significant impact on authorisation rates. If an issuer thinks its cardholder could have a negative experience with your business, a transaction might be declined to preemptively avoid potential risk. Use third-party fraud detection tools to block unauthorised transactions. And try to resolve disputes before they turn into chargebacks. Solutions like RDR and prevention alerts can help.
- Strategically retry declined authorisations. Determine which response codes are hard declines and which are soft declines. Soft declines — response codes issued when there are technology or account glitches that might be resolved — could be attempted again in the future.
- Send more data in your transaction message. The better the bank understands the purchase and your business, the more likely it is to approve the authorisation request.
- Use Mastercard’s Automatic Billing Updater (ABU) if you process card-on-file and recurring transactions. ABU automatically updates card information in real time so you’ll have fewer declines when account details expire.
- Replace card data with network tokens. When a card is reissued or expires, tokens automatically update. And tokens send a higher trust signal to issuers than card data.
- Match your merchant account location with the card issuer location. Because cross-border transactions can have a higher decline rate, work with an acquirer that does business in your target market. For example, if you are selling in Europe, get a European merchant account.
- Check to make sure you have the right merchant category code (MCC) assignment. If you use an MCC that doesn’t accurately reflect your business, you might have unnecessary declines.
We recommend you watch this trigger carefully as the scam initiative unfolds. One of the stipulations — “at least a 72-hour period” — is fairly ambiguous. A flat 72-hour timeline would be easy to understand. But the inclusion of “at least” could technically mean months or years. So if your authorisation rate decreases slightly yet consistently over the span of a year, for example, the activity could potentially trigger a scam investigation.
TRIGGER #4
CAUSE: Two different issuers raised a red flag about your business. They did this in one of two ways.
Either they reported at least one transaction each as a scam, using fraud type 56 (manipulation of cardholder). Or, they both initiated chargebacks — fraud or non-fraud — with supporting documentation referring to scams, manipulation of the cardholder, or something similar.
TIMELINE: Applicable within the first six months of a MID’s issuance.
POTENTIAL IMPLICATIONS: Industry data reveals that approximately 70% of chargebacks are cases of friendly fraud — false, inaccurate, or incomplete cardholder complaints.
It is not uncommon for a cardholder to contact the bank and complain about your products, business model, or communication style — even if the complaints aren’t 100% accurate.
What is uncommon is classifying those complaints as scams — and implementing penalties for as few as two over the course of six months.
Consider a hypothetical example.
A streaming platform runs an ad: “Watch World Cup games here!”. A soccer fan signs up for a month of streaming to watch the upcoming games. Later, the cardholder realises that the streaming platform is only showing the group stage games — knockout games aren’t included. Frustrated, the cardholder contacts the bank and rants about the streaming platform being a scam. Technically, the ad wasn’t misleading. It didn’t say “Watch all the World Cup games” or “Watch every World Cup game”. The cardholder just misunderstood what was being offered. And yet, the merchant is penalised.
Because of this new scam classification, your business needs to do everything honestly and ethically — especially within the first six months of obtaining a new MID. Here are some updates you may want to make.
- Review your website, marketing materials, and advertisements. If any of your messaging borders on dishonest or could, in any way, be misconstrued, update it.
- Check the quality of your goods or services. Does the price align with your customers’ perceived value? Discrepancies could cause trouble.
- Audit your customer service practices. Slow response times, uneducated responses, or incorrect actions could seem like a scam.
Worried that parts of your business model might be considered “manipulation of the cardholder”? Schedule a call with our team. We provide free payment strategy consultations. Let’s talk through what you’re concerned about.
TRIGGER #5
CAUSE: More than 5% of your transactions resulted in either a refund or chargeback during a 30-day rolling period.
STIPULATIONS: Applicable only if you process 500 or more transactions during the specified time period.
TIMELINE: Applicable within the first six months of a MID’s issuance.
POTENTIAL IMPLICATIONS: This trigger is, for the majority of merchants, the biggest concern.
We’re all accustomed to keeping the chargeback-to-transaction ratio within card brand limits. But now, Mastercard is adding refunds to the monitoring requirements too.
And that’s a big deal.
Because it’s common for merchants to issue refunds as a way to resolve disputes and prevent chargebacks.
But now, those problem-solving tactics are allegedly warning signs of a scam.
To avoid this unpleasant classification, check your business’s policies and procedures. Focus on improving the customer experience so neither refunds nor chargebacks are warranted. Here are a couple suggestions. For a complete list, check our chargeback prevention guide.
- Use billing descriptors that are easy to recognize and understand. Help customers remember their purchases and know who they did business with.
- Promptly respond to customer emails and minimise call wait times. The quicker you can address and resolve an issue, the better.
- Make sure your product descriptions are accurate, detailed, and easy-to-understand.
- Write customer-friendly return, cancellation, and refund policies. Make your policies easy to find — include them in your website footer, the checkout page, and order confirmation emails.
- If you offer subscriptions, clearly disclose your terms and conditions. Explain when the card will be charged and for how much. Send a reminder email before the next billing cycle. Include a link to your cancellation policy and a way to easily cancel the subscription.
You should also check your reporting capabilities. Make sure you have a way to collect, consolidate, and monitor both chargeback and refund data.
Lastly, be mindful of the “30-day rolling period” stipulation.
Your chargeback-to-transaction ratio is traditionally monitored on a monthly basis. There is a clear beginning and ending of the time period. But a rolling period should be monitored differently. Essentially, your threshold resets daily. Today you might be compliant, but tomorrow you aren’t.
Need help navigating Mastercard’s scam merchant program?
The scam merchant monitoring program will likely have a significant impact on the payments industry. Fortunately, you don’t have to face this massive update alone.
We suggest you first start by talking with your acquirer. We are seeing acquirers create their own rules related to this announcement. Check to see what your acquirer’s expectations are.
Next, contact AltoPay when you are ready to adjust your payment strategy. We can help prevent possible investigations or respond to any actions taken against your MIDs.
Our aim is to help merchants achieve stable, reliable payment processing — and that includes navigating the latest card brand program updates.
AUTHOR
Jessica Velasco
For more than a decade, Jessica Velasco has been a thought leader in the payments industry. She aims to provide readers with valuable, easy-to-understand resources.
